PT-2022-18837 · Jenkins · Jenkins Rocketchat Notifier Plugin+1

Marc Heyries · Published 2022-03-29 · Updated 2023-11-17 · CVE-2022-28139

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins RocketChat Notifier Plugin versions 1.4.10 and earlier

Description A missing permission check in the Jenkins RocketChat Notifier Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. This issue also results in a cross-site request forgery (CSRF) vulnerability due to the lack of requirement for POST requests in the form validation method.

Recommendations For Jenkins RocketChat Notifier Plugin versions 1.4.10 and earlier, update to version 1.5.0 or later, which requires POST requests and Overall/Administer permission for the affected form validation method, thus mitigating the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-28139

GHSA-4P8F-2FWV-6XCW

Affected Products

Jenkins

Jenkins Rocketchat Notifier Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-4p8f-2fwv-6xcw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28139 · Security Note
• https://jenkins.io/security/advisory/2022-03-29/#SECURITY-2241 · Vendor Advisory
• https://github.com/jenkinsci/rocketchatnotifier-plugin/commit/1a0023be9f2e143434d028d5292ef9dc3195d051 · Note
• https://github.com/jenkinsci/rocketchatnotifier-plugin · Note
• http://openwall.com/lists/oss-security/2022/03/29/1 · Note
• https://t.me/cvenotify/60602 · Telegram Post
• https://t.me/cibsecurity/39732 · Telegram Post